0
Consider following scenario:
I am logged on serverA as a user 'common'. The key thing about common user is that a bunch of people have access to it - it is unrestricted and unsecure by design.
Let's say, I periodically need to login from this user/server to serverB as user secure - i.e. I need to scp files owned by secure@serverB.
While I have full access and control over secure user, I certainly do not want to add common's public key to trusted keys for secure user - I do not want anyone who can login as common to be able to login as secure as well.
I also do not want to type in secure's password 5 times per hour. Ideally, I'd like to type it once, have some agent or so magically remember it - but only for this login session - and than use it anytime I connect from this session until the timeout expires. Not unlike kinit
, actually.
Is there anything out there which could achieve this goal?
From what I know about it, I do not - as per my knowledge ssh-agent remembers passphrase for password-protected key files. My case doesn't allow me to use ssh key files. If I am mistaken, can you please explain exactly how I'd use ssh-agent in this scenario? – SergeyA – 2019-11-05T22:43:20.590
Oh, I misunderstood that you wanted to log in from the
common
account to thesecure
account. This isn't secure to begin with, as other people with access to thecommon
account could try to, say, add a differentssh
executable to the path that logs passwords or whatever. Any reason why you can't log into thesecure
account directly and scp files in the other direction? – jjlin – 2019-11-05T23:07:31.200It is as secure as it gets. As I explain in my use case, I do not want to create any permanent files which would be accessible to common login. I want a way to login without password in this particular login session, again, similar to the way kinit works. – SergeyA – 2019-11-06T01:28:30.600
Well, if that's really how you want to do it, then you would create an SSH key protected with a password that you keep secret from other users. Then you
– jjlin – 2019-11-06T01:45:53.310ssh-add
that tossh-agent
. In your shell, yourssh
calls will use the value ofSSH_AUTH_SOCK
to communicate withssh-agent
. If othercommon
users know how to set theirSSH_AUTH_SOCK
to the right value, then they can use your agent too, similar to knowing the right value forKRB5CCNAME
.BTW, in case your
– jjlin – 2019-11-06T01:54:12.417serverB
is in fact only network-accessible viaserverA
, there are various ways to useserverA
as a "jump host".ProxyJump
provides direct support in newer versions.